Verify your download

Every release is signed with my personal GPG key. Verifying the signature confirms that the file you downloaded is exactly what was published on GitHub, and hasn't been tampered with or corrupted along the way.

  1. Install GnuPG

    You'll need the gpg command line tool.

    • Linux: usually preinstalled; otherwise sudo apt install gnupg (or your distro's equivalent).
    • macOS: brew install gnupg
    • Windows: install Gpg4win, then use "Gpg4win Compatible" or a terminal with gpg on the PATH.

  2. Import my public key

    Fetch the key from the Ubuntu keyserver:

    gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 05B861C404ED688D

  3. Check the fingerprint

    Don't skip this — importing a key proves nothing on its own. Print the fingerprint of the key you just imported:

    gpg --fingerprint 05B861C404ED688D

    It must match this exactly:

    6B02 8B2D D159 DCE8 C418  B5BF 05B8 61C4 04ED 688D

    You can cross-check it against the public key listing on the keyserver. If it doesn't match, stop — do not trust the download.

  4. Download the release and its signature

    Grab both the package (e.g. besprited-v1.26.06-linux-x86_64.zip) and its matching .sig file (e.g. gpg-besprited-v1.26.06-linux-x86_64.zip.sig) from the download page or the GitHub releases page, and place them in the same folder.

  5. Verify the signature

    Run, substituting the actual filenames:

    gpg --verify gpg-besprited-v1.26.06-linux-x86_64.zip.sig besprited-v1.26.06-linux-x86_64.zip

  6. Read the result

    A successful check prints Good signature from "Daniel Praźmo <d.prazmo@icloud.com>" along with the same fingerprint from step 3. A warning that the key is not certified with a trusted signature is expected and fine — that's just GPG's web of trust, and doesn't affect the verification. What matters is "Good signature" plus a matching fingerprint.

    If you instead see BAD signature, do not use the file — re-download it, and if the problem persists, open an issue.